Skip to main content
Self-hosted LangSmith is an add-on to the Enterprise plan designed for LangChain’s largest, most security-conscious customers. See pricing for details, or contact sales to request a license key for trial.
LangChain publishes production-ready Terraform modules for LangSmith self-hosted at github.com/langchain-ai/terraform. The modules provision the cloud foundation (network, cluster, database, cache, object storage, secrets, DNS) and install the LangSmith Helm chart with sensible defaults. Use this path when you want infrastructure as code from day one. If you already manage cloud infrastructure with your own tooling and need just the application install, follow the Helm installation guide instead.
Prefer Helm? The Kubernetes setup guide walks through installing with Helm against any conformant cluster, no Terraform required. The Terraform path bundles cluster provisioning, secrets wiring, and the Helm release into one workflow.

​
Choose a provider

AWS (EKS)

Provision EKS, RDS PostgreSQL, ElastiCache, S3, and networking.

Azure (AKS)

Provision AKS, Azure Database for PostgreSQL, Azure Managed Redis, Blob Storage, and Key Vault.

GCP (GKE)

Provision GKE, Cloud SQL, Memorystore, GCS, and Workload Identity.

​
Prerequisites

Install the following tools before running the modules:
ToolVersionPurpose
terraform1.5Run the modules
kubectl1.33Inspect the cluster after provisioning
helm3.12Manage the LangSmith chart release
Cloud CLIlatestaws, az, or gcloud for the target provider
You also need:
  • A LangSmith license key. Contact sales to request one.
  • Permissions in the target cloud account to create VPC or VNet networking, a managed Kubernetes cluster, managed databases, object storage, secrets, and IAM roles.
  • A registered domain (or subdomain) for the LangSmith UI endpoint.

​
Deployment tiers

Pick a tier with a single Terraform variable. The modules size every dependent resource accordingly.
TierPostgreSQLRedisClickHouseUse case
devIn-clusterIn-clusterIn-clusterDemos, evaluations, short-lived POCs
productionCloud-managed (RDS, Cloud SQL, Azure Database)Cloud-managed (ElastiCache, Memorystore, Azure Cache)LangChain Managed ClickHousePersistent, scalable production
production-largeCloud-managed, larger instance classCloud-managed, larger instance classLangChain Managed ClickHouseHigh-throughput production
Use in-cluster ClickHouse for development and POC, not production. Production deployments must use LangChain Managed ClickHouse or a self-managed external ClickHouse cluster. Blob storage is always required because trace payloads must not live in ClickHouse.

​
What the modules provision

  • Networking: VPC or VNet with public and private subnets, NAT, and security groups.
  • Compute: Managed Kubernetes (EKS, AKS, or GKE) with autoscaling node pools sized per tier.
  • Data plane: Managed PostgreSQL, managed Redis or cache, and a blob storage bucket for trace payloads.
  • Secrets: Cloud-native secret store (AWS SSM Parameter Store, Azure Key Vault, GCP Secret Manager) synced into Kubernetes by External Secrets Operator.
  • Ingress: Cloud-native load balancer by default. Envoy Gateway (Gateway API) is available for multi-namespace dataplane deployments.
  • Optional hardening (AWS today): AWS Network Firewall with FQDN egress allowlists, WAFv2, CloudTrail, and a private EKS API endpoint with SSM bastion access.

​
Enterprise feature toggles

Each module exposes flags for the optional LangSmith add-ons. Toggle each in the tfvars file before running make apply.
  • LangSmith Deployment (enable_deployments): Agent Server plus the host-backend, listener, and operator that run and manage deployed agents.
  • Fleet (enable_fleet): The agent-building product, formerly Agent Builder, deployed as a standalone service (chart v0.15+).
  • Insights (enable_insights): ClickHouse-backed analytics.
  • Polly (enable_polly): AI evaluation and monitoring.

​
Next steps

Connect these docs to Claude, VSCode, and more via MCP for real-time answers.
Edit this page on GitHub or file an issue.